LSASS Process Memory Dumped via Remote SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to dump the LSASS process memory remotely over SMB. It specifically looks for network traffic on TCP port 445 (SMB) containing the string "lsass.dmp" in a case-insensitive manner, indicating a potential credential dumping activity.